critical
CVE-2025-54379
eKuiper API endpoints handling SQL queries with user-controlled table names.
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high).
Description
LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lf-edge/ekuiper, github.com/lf-edge/ekuiper/v2 | 2.2.1 |
Show all 2 entries from 1 source
| Source | Package | Fixed in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lf-edge/ekuiper | no fix listed |
| go::GitHub Security Advisory Go | github.com/lf-edge/ekuiper/v2 | 2.2.1 |